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^ MF.THOn FOP MONTTORTNO AT LEAST ONE SENSOR 



Background Information 

The present invention starts out from a method for monitoring 
at least one sensor according to the species of the 
independent claim. 

Advantges of the Invention 

The method of the present invention for monitoring at least 
one sensor having the features of the independent claim has 
the advantage that a reaction adapted to an error pattern 
having a certain error message may occur and that each sensor 
error is prevented from resulting in the sensor signal not 
being able to be used or in the system identifying a permanent 
sensor error and consequently a system defect. As a result, 
interference that does not signify lasting sensor damage and 
may even be attributed to rare yet possible operating states 
is not penalized too strictly. Examples of this are 
electromagnetic interference coupling and hammer blow- related 
vibrations. This improves the operability or sensitivity of 
the systems and reduces the probability of control unit field 
outage. In particular, the present invention renders it 
possible via adaptation and application for the particular 
target control unit and vehicle to better address the 
different system requirements or customer requirements with 
respect to activation parameters and error management. 

Consequently, the performance and robustness of the entire 
system are able to be increased, and the field outage rates 
are able to be reduced since as a result of the more in-depth 
error pattern detection, total failure is not detected for all 
error patterns. In addition, the present invention is 
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" * advantageous because error detection and optimization are able 
to be facilitated in the restraint system development and 
testing phase. However, use of the present invention is also 
possible and practical in other automobile application areas 
5 in which sensors are used, in particular in vehicle dynamics 
control and navigation. 

It is particularly advantageous for the parameters from which 
the error pattern is formed to include at least one error 
message and/or a time duration of the at least one error 

10 message or error and/or at least one sensor signal of the 
sensor to be checked and/or at least one additional sensor 
signal of at least one additional sensor and/or at least one 
status signal of a vehicle component. This allows exact 
analysis of the error which may be corrected in particular 

15 using a look-up table. The error pattern is generated using 

the look-up table in the processor of the control unit and may 
then be evaluated accordingly. In particular it is 
consequently possible for the control unit to detect whether 

« 

the error is a permanent error and how significant the error 
,20 is. 

The measures and further refinements specified in the 
dependent claims render possible advantageous improvements of 
the method for monitoring at least one sensor recited in the 
independent claim . 

25 It is particularly advantageous that a rotation- rate sensor is 
used in which an error word is transmitted in an 8 -bit word, 
provided with the abbreviation MONI in this case, in a 16 -bit 
frame. In this context, the error type or modes are 
characterized in this word by flags. Therefore, different 

3 0 detected error modes and extraordinary operating states are 

indicated by this word. Error modes indicate that at least one 
sensor parameter is outside of a predefined range. The sensor 
parameters are monitored inside the sensor. The word MONI may 
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be accordingly assigned information doubly or multiply via two 
or more different MONI read commands. 

If during such a monitoring operation an error is detected, a 
respective value is set in a respective register. This means 
that an error register is assigned a logical 1. If this error 
is no longer detected, the respective register is reset. 
Therefore, a logical 0 is set again. 

It is also advantageous that the sensor itself is positioned 
within the housing of the control unit . The sensor and the 
processor of the control unit are then connected to one 
another via the digital interface and preferably SPI (serial 
peripheral interface) lines, respectively . 

Drawing 

Exemplary embodiments of the present invention are shown in 
the drawing and are explained more closely in the following 
description. 



The figures show: 



Figure 1 shows a block diagram of the control unit of the 
present invention; 

Figure 2 shows a data telegram of the present invention; 

Figure 3 shows a look-up table 

Figure 4 a block diagram of the method of the present 
invention; and 

Figure 5 shows a flow chart of the method of the present 
invention . 



Description 
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Rotation-rate sensors, as well as other sensors, are used 
increasingly in electronic restraint systems for passive 
vehicle safety. Rotation-rate sensors are integral in the 
detection of rollover occurrences and related accident 
5 occurrences, e.g. the soil trip. 

The rotation-rate sensors used in the restraint systems 
generally have an internal sensor monitoring function. In the 
case of analog sensor interfaces to the system, an identified 
error or interference state that may have a wide range of 
10 causes is communicated via a logic signal (error, no error) to 
a sensor platform, a control unit, generally a 
microcontroller, or a safety semiconductor. 

Digital sensors provide the possibility that is relatively 
simple to implement in technical terms to transmit different 

15 errors and interference states to the system via fixedly 

assigned bits in data words. In this context, every bit is 
assigned an error flag that is then assigned to a circuit 
block or a measured variable inside the sensor. The internal 
sensor monitoring function generally responds when and as long 

2 0 as one of the various monitored measured variables inside the 
sensor assumes a value not allowed for the corresponding 
sensor. The causes vary in relation to the sensor evaluation 
circuit function blocks. 

Possible causes of interference or error states: 

25 

In the case of rotation-rate sensors used in automobile 
systems, principle- related vibration or mechanical 
interference susceptibility is a characteristic property to be 
taken into consideration in the sensor application. If no 
30 mechanical damping occurs, the performance of the systems is 
imitated. Mechanical damper construction entails significant 
additional development and production costs. Impacts and 
significant vibrations may interfere with the sensor element 
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so significantly that internal sensor regulations are no 
longer effective for a certain time and the sensor is outside 
its specified function range. Further possible interference 
includes electromagnetic interference coupling. Errors in the 
sensor itself or in the application circuit may also affect 
system functioning. The effects differ depending on rotation- 
rate sensor error, interference type, and also application 
environment of the sensor, i.e.,/ the circuit, circuit board, 
and vehicle construction . 

To date, the rotation-rate sensor monitoring function has been 
used on the system side only for basic error detection. This 
means to determine whether the sensor is OK. The restraint 
system differentiates with respect to its reaction over the 
time duration of the error message on the basis of whether 
there is rotation-rate sensor failure. The particular system 
reaction is not adjusted to the different error messages. 

Since there is no classification of the different error 
patterns on the system side and the application environment is 
not applied, the "worst case scenario" principle must be 
followed. A state identified by the monitoring function as 
faulty results in the sensor signal not being able to be used 
or in the system being identified as having a permanent sensor 
error and consequently a system defect- As a result, 
interferences that do not signify lasting sensor damage and 
may even be attributed to rare yet possible operating states 
are generally penalized too strictly. This limits the 
performance or sensitivity of the systems or increases the 
probability of a possibly unnecessary control unit field 
outage . 

Therefore, an error word transmitted from the sensor to the 
system, preferably a processor of the control unit, and having 
a combination of different error modes and thereby 
transmitting precise information regarding the error type and 
cause to the system is used in accordance with the present 
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invention. The system consequently reacts to the error word in 
an adapted manner . 

Error patterns due to various error and interference causes 
are already recorded in the development and application phase 
5 of restraint system electronics systems. This makes it 

possible to complete a look-up table. In this context, the 
particular error pattern may be comprised of an error message 
or an error word, an error state word, a time duration of the 
error message, a sensor output signal, and additional sensor 

10 signals available in the system as well as status information. 
The availability of such a look-up table allows the system to 
react appropriately to the particular error pattern. Error 
patterns that are unknown or are not secured by testing are 
penalized as a worst case. Consideration of the particular 

15 correctly present vehicle environment allows a further 

increase in the detection precision of errors and interference 
causes . 

A practical requirement for implementing the present invention 
is a digital sensor interface. Only in this manner are a 
20 greater number of different errors and interference modes or 
patterns and also combinations thereof that occur in a sensor 
able to be transmitted to the system. The bi-directional SPI 
(serial peripheral interface) is used as an example in this 
instance . 

25 Figure 1 shows a block diagram of the control unit of the 

present invention. Located in a control unit 10 is a sensor 1, 
which is connected to a processor 7 via a digital line 6. 
Processor 7 is connected via a data input /output to a memory 
8. Processor 7 is connected via a data output to a restraint 

30 system 9. Located in sensor 1 is a sensor element 2 for 
measuring a measured variable, e.g. of rotation rates or 
rotational accelerations. The sensor element may be in 
particular a micromechanical sensor structure. Sensor element 
2 is connected to a functional and monitoring component 3, in 
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which the analog-digital conversion of the sensor signal, in 
some instances the drive and regulation of the sensor element, 
and the internal sensor monitoring functions are performed. 
Functional and monitoring component 3 is connected via a data 
5 output to a transmitter component 4. Transmitter component 4 

is connected to digital line 6, which is configured here as an 
SPI (serial peripheral interface) line. One or more sensors 5, 
the signals of which are transmitted via the SPI and are also 
applied to the error pattern, may also be connected to the 
10 SPI. 

Figure 4 shows which measured values are processed here. 
Specific rotation-rate sensor error words 17 transmitted as 8- 
bit words are used to generate the error pattern. A variable 
18 provides the particular time duration of the individual 

15 error messages. A variable 19 provides the sensor value 

determined via sensor element 2 . This is also monitored for 
operability. A variable 20 is used if applicable to process 
the variables from other sensors 5. They may also provide a 
type of plausibility for the error message. Variable 21 

20 provides other status information regarding the restraint 

system or other vehicle components. These are also applied to 
the error pattern generation. These input variables are then 
used by evaluation module 4 via a stored look-up table, i.e. a 
matrix, to generate an error pattern. The input parameters 

25 determine the rows and columns of the matrix and then result 

in the generation of the error pattern in block 22, the system 
then reacting to this in block 23 after transmission to 
processor 7. Processor 7 is also designed via its memory 8 for 
decoding the error pattern so that it is clear to processor 7 

30 which errors resulted in this error pattern. If there are 

error patterns that are not known in processor 7, a worst case 
is assumed, i.e., sensor failure. As a function of this, the 
processor detects failure of the subsystem affected by this 
sensor failure and introduces corresponding measures. 
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Figure 3 schematically shows such a matrix designated here as 
the look-up table. The input parameters are in columns 14 and 
13 and the error patters that belong to these input parameters 
are then in field 15 . 

Figure 2 schematically shows a data frame of 16 bits that is 
divided into a first part 12 and a second part 11. Error word 
11 (MONI) is transmitted in second part 11. Two error words 
may be transmitted here. Error word 1 is read out via read 
command 1, and error word 2 is read out via read command 2. 

Figure 5 shows a flow chart of the method of the present 
invention. As shown above, the error pattern- is generated in 
method step 24 on the basis of input parameters 17 through 21 
in block 16 using a look-up table according to Figure 3. The 
error pattern is then transmitted in method step 25 to 
processor 7. The processor reacts to this error pattern in 
method step 26. 

Sensor 1 may alternatively be located outside of control unit 
10. Instead of only one sensor 1, a plurality of sensors of 
different types may also be used and monitored. In addition to 
the restraint system addressed here, other vehicle systems are 
also suitable for this invention, e.g. a vehicle dynamics 
system or navigation system. 
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